v1

type ContainerMetadata struct {
	// Container id
	Id string `json:"id"`
	// Container name
	Name string `json:"name"`
}

type KiveAlert struct {
	// KiveAlert version
	AlertVersion string `json:"kive-alert-version"`
	// The policy that triggered the alert
	PolicyName string `json:"kive-policy-name"`
	// Alert creation time
	Timestamp string `json:"timestamp"` // RFC 3339
	// Additional information
	Metadata KiveAlertMetadata `json:"metadata"`
	// User specified metadata (from KivePolicy)
	CustomMetadata map[string]string `json:"custom-metadata"`
	// Information about the pod where the file lives
	Pod PodMetadata `json:"pod"`
	// Information about the node
	Node NodeMetadata `json:"node"`
	// Information about the process that accessed the file
	Process ProcessMetadata `json:"process"`
}

type KiveAlertMetadata struct {
	// File path
	Path string `json:"path"`
	// Inode number of the file
	Inode uint64 `json:"inode"`
	// Unix access permission mask
	Mask int32 `json:"mask"`
	// ID of the kernel where the alert was triggered
	KernelID string `json:"kernel-id"`
	// Callback URI
	Callback string `json:"callback"`
}

type KiveData struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec KiveDataSpec `json:"spec,omitempty"`
}

type KiveDataList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KiveData `json:"items"`
}

type KiveDataSpec struct {
	// The inode number of the file
	InodeNo uint64 `json:"inode-no,omitempty"`
	// The device number of the inode
	DevID uint32 `json:"dev-id,omitempty"`
	// (optional) Additional information
	Metadata map[string]string `json:"metadata,omitempty"`
}

type KivePolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec KivePolicySpec `json:"spec,omitempty"`
}

type KivePolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KivePolicy `json:"items"`
}

type KivePolicySpec struct {
	// Version for KiveAlert output
	AlertVersion string `json:"alertVersion,omitempty"`
	// List of traps
	Traps []KiveTrap `json:"traps,omitempty"`
}

type KiveTrap struct {
	// Specifies which path to monitor
	Path string `json:"path,omitempty"`
	// (optional) Whether to create the file or not if It was not found
	Create bool `json:"create,omitempty"`
	// (optional) The permissions of the file to be created if create is set to true
	Mode uint32 `json:"mode,omitempty"`
	// (optional) Send an HTTP POST request to this endpoint
	Callback string `json:"callback,omitempty"`
	// (optional) Additional information for this trap
	Metadata map[string]string `json:"metadata,omitempty"`
	// Match any of the following items (logical OR), at least one must be present
	MatchAny []KiveTrapMatch `json:"matchAny,omitempty"`
}

type KiveTrapMatch struct {
	// Filter pods by name
	PodName string `json:"pod,omitempty"`
	// Filter container by name.
	//  - if this field is prepended by "regex:", the rest of the string
	//    will represent a regular expression matched with go regexp
	//    library (https://golang.org/s/re2syntax)
	//  - if the field is prepended by "glob:", then this is a
	//    filesystem-style regex, as described in go filepath.Match
	//    library (https://pkg.go.dev/path/filepath#Match)
	//  - otherwise, the name of the container will be compared exactly
	ContainerName string `json:"containerName,omitempty"`
	// Filter pods by namespace
	Namespace string `json:"namespace,omitempty"`
	// Filter pods by IP
	IP string `json:"ip,omitempty"`
	// Filter pods by label
	MatchLabels map[string]string `json:"matchLabels,omitempty"`
}

type NodeMetadata struct {
	// Name of the node
	Name string `json:"name"`
}

type PodMetadata struct {
	// Pod name
	Name string `json:"name"`
	// Pod namespace
	Namespace string `json:"namespace"`
	// Pod ip
	Ip string `json:"ip"`
	// Information about the container
	Container ContainerMetadata `json:"container"`
}

type ProcessMetadata struct {
	// Process ID
	Pid int32 `json:"pid"`
	// Thread group ID
	Tgid uint32 `json:"tgid"`
	// User ID
	Uid uint32 `json:"uid"`
	// Group ID
	Gid uint32 `json:"gid"`
	// Process binary
	Binary string `json:"binary"`
	// Current Working Directory
	Cwd string `json:"cwd"`
	// Arguments to the Binary
	Arguments string `json:"arguments"`
}